Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Use-after-free in Linux kernel's netfilter: nf_tables component

Glibc: buffer overflow in ld.so leading to privilege escalation

Linux Kernel Improper Authentication Vulnerability

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is…

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final…

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c

HTTP/2 push headers memory-leak

Openssh: regresshion - race condition in ssh allows rce/dos

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that…

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary…

A vulnerability classified as problematic was found in vim up to 9.1.1096

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using…

Possible denial of service in X.509 name checks

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for…

An issue was discovered in Python before 3.11.1

An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote…

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

The c_rehash script allows command injection

eventfd double close

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP…

In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in…

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel

GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit

An issue was discovered in the Linux kernel through 5.6.11

OCSP stapling bypass with GnuTLS

TLS certificate check bypass with mbedTLS

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value,…

QUIC certificate check bypass with wolfSSL

REXML is an XML toolkit for Ruby

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly

An issue was discovered in the Linux kernel through 5.16.11

When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and…

Vim is an open source command line text editor

Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI)

The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space

Vulnerability in Oracle Java SE (component: Compiler)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)

Vim is an open source, command line text editor

The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling

A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not…

Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198

REXML is an XML toolkit for Ruby